Linux Kernel vulnerabilities

CVE-2025-39917 [HIGH] CWE-787 CVE-2025-39917: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds dynptr w In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt Stanislav reported that in bpf_crypto_crypt() the destination dynptr's size is not validated to be at least as large as the source dynptr's size before calling into the crypto backend with 'len = src_len'. This can result in an

CVE-2025-39854 [HIGH] CWE-416 CVE-2025-39854: In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_ In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_use in ice_ll_ts_intr Recent versions of the E810 firmware have support for an extra interrupt to handle report of the "low latency" Tx timestamps coming from the specialized low latency firmware interface. Instead of polling the registers, software can

CVE-2026-46281 [HIGH] CWE-787 CVE-2026-46281: In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix buffer overflow in In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix buffer overflow in vrealloc_node_align() Commit 4c5d3365882d ("mm/vmalloc: allow to set node and align in vrealloc") added the ability to force a new allocation if the current pointer is on the wrong NUMA node, or if an alignment constraint is not met, even if the user i

CVE-2026-31488 [HIGH] CWE-416 CVE-2026-31488: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip un In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commit 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in atomic check"), amdgpu resets the CRTC state mode_changed flag to false when recomputing the DSC configuration results in no timing cha

CVE-2025-39951 [HIGH] CWE-416 CVE-2025-39951: In the Linux kernel, the following vulnerability has been resolved: um: virtio_uml: Fix use-after-f In the Linux kernel, the following vulnerability has been resolved: um: virtio_uml: Fix use-after-free after put_device in probe When register_virtio_device() fails in virtio_uml_probe(), the code sets vu_dev->registered = 1 even though the device was not successfully registered. This can lead to use-after-free or other issues.

CVE-2026-46197 [HIGH] CWE-787 CVE-2026-46197: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: validate SVM ioctl In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: validate SVM ioctl nattr against buffer size Validate nattr field against the buffer size, preventing out-of-bounds buffer access via user-controlled attribute count. (cherry picked from commit 5eca8bfdfa456c3304ca77523718fe24254c172f)

CVE-2026-43205 [HIGH] CWE-787 CVE-2026-43205: In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: validate num_ifs In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: validate num_ifs to prevent out-of-bounds write The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes() but never validates it against DPSW_MAX_IF (64). This value controls iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices into t

CVE-2026-46097 [HIGH] CWE-416 CVE-2026-46097: In the Linux kernel, the following vulnerability has been resolved: Input: edt-ft5x06 - fix use-aft In the Linux kernel, the following vulnerability has been resolved: Input: edt-ft5x06 - fix use-after-free in debugfs teardown The commit 68743c500c6e ("Input: edt-ft5x06 - use per-client debugfs directory") removed the manual debugfs teardown, relying on the I2C core to handle it. However, this creates a window where debugfs files are still accessib

CVE-2026-53148 [HIGH] CWE-787 CVE-2026-53148: In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain resp In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the de

CVE-2026-31452 [HIGH] CWE-787 CVE-2026-31452: In the Linux kernel, the following vulnerability has been resolved: ext4: convert inline data to ex In the Linux kernel, the following vulnerability has been resolved: ext4: convert inline data to extents when truncate exceeds inline size Add a check in ext4_setattr() to convert files from inline data storage to extent-based storage when truncate() grows the file size beyond the inline capacity. This prevents the filesystem from entering an inconsi

CVE-2026-31401 [HIGH] CWE-787 CVE-2026-31401: In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overfl In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big, because it's the return value of dispatch_hid_bpf_raw_requests(), which calls the struct_ops a

CVE-2023-54207 [HIGH] CWE-416 CVE-2023-54207: In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Correct devm devi In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Correct devm device reference for hidinput input_dev name Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently f

CVE-2026-53388 [HIGH] CWE-416 CVE-2026-53388: In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before re In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end the request and free the fuse_io_args (eg fuse_readpages_end()) while the subsequent copy chain

CVE-2026-53096 [HIGH] CWE-476 CVE-2026-53096: In the Linux kernel, the following vulnerability has been resolved: bpf: Use RCU-safe iteration in In the Linux kernel, the following vulnerability has been resolved: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path The DEVMAP_HASH branch in dev_map_redirect_multi() uses hlist_for_each_entry_safe() to iterate hash buckets, but this function runs under RCU protection (called from xdp_do_generic_redirect_map() in softirq context). Con

CVE-2026-53234 [HIGH] CWE-416 CVE-2026-53234: In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: Fix use-after-f In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: Fix use-after-free during device removal The driver was using devm_register_netdev() which causes unregister_netdev() to be deferred until the devres cleanup phase, which runs after emac_remove() returns. This creates a use-after-free window where: 1. emac_remove() i

CVE-2026-31507 [HIGH] CWE-415 CVE-2026-31507: In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores the pointer in pipe_buffer.private. The pipe_buf_operations for these buffers used .get = generic_pipe_buf_get, which only increment

CVE-2026-23243 [HIGH] CWE-787 CVE-2026-23243: In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padd

CVE-2026-23073 [HIGH] CWE-787 CVE-2026-23073: In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: Fix memory corruptio In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: Fix memory corruption due to not set vif driver data size The struct ieee80211_vif contains trailing space for vif driver data, when struct ieee80211_vif is allocated, the total memory size that is allocated is sizeof(struct ieee80211_vif) + size of vif driver data. The si

CVE-2026-22980 [HIGH] CWE-416 CVE-2026-22980: In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_en In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_trackin

CVE-2026-53209 [HIGH] CWE-787 CVE-2026-53209: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject ove In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broadcast Announcement service data to that payload, the combined data may no l